Dashboards & Visualizations

replacing a comma with a space in a token from a dashboard

Explorer

Hello All,

I have a query in my dashboard

Routing_Location="$Routing_Location$" | fillnull | stats count(_raw) AS Attempts by ANI,Routing_Location | sort -Attempts

The issue is that when someone puts in the test field for example "USA,Cellular_Verizon" no search comes up but when I put in "USA Cellular_Verizon" the search does come up I need a way to replace the comma with a space before the search take place (probably in the XML side)

I have already tried | rex field=Routing_Location mode=sed "s/(\w+)([^\w]+)(\w+)([^\w]+)(\w+)/\1 \3 \5/"
But that has no effect

Thanks in Advanced I hope someone can help!

0 Karma
1 Solution

Revered Legend

Give this a try

[| makeresults | eval Routing_Location=replace("$Routing_Location$",","," ") | table Routing_Location] | fillnull | stats count(_raw) AS Attempts by ANI,Routing_Location | sort -Attempts

View solution in original post

Revered Legend

Give this a try

[| makeresults | eval Routing_Location=replace("$Routing_Location$",","," ") | table Routing_Location] | fillnull | stats count(_raw) AS Attempts by ANI,Routing_Location | sort -Attempts

View solution in original post

Explorer

Hi this worked well! it did take longer for my search to get results but it worked!!! thank you so much can I vote you comment as the right answer?

0 Karma

Revered Legend

Here you go.

Also, for better performance, include one or more metadata fields as filters e.g. index , sourcetype, source or host. You must be searching on a finite number of index/sourcetype, so include them. query runs faster for you and less impact on your infrastructure.

0 Karma

Explorer

One more question I have for you. Can you explain the mix of the make results and the replace because when I looked at the documentation I didn't see anything with replace("$token$",","," ") I'm curious how it work for future reference.

Thanks so much again I've really been searching Forums for days and nothing has worked!

0 Karma

Splunk Employee
Splunk Employee

Try putting double quotes around Routing_Location in the stats:

Change from this:
Routing_Location="$Routing_Location$" | fillnull | stats count(_raw) AS Attempts by ANI,Routing_Location | sort -Attempts

To this:
Routing_Location="$Routing_Location$" | fillnull | stats count(_raw) AS Attempts by ANI, "Routing_Location" | sort -Attempts

0 Karma

Explorer

Hi this didn't work for me. but thanks for the answer!

0 Karma

SplunkTrust
SplunkTrust

Have you tried | rex field=Routing_Location mode=sed "s/,/ /g"?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Explorer

Hi Rich Galloway I have tried that it hasn't worked either sadly

Routing_Location="USA,Cellular_Verizon" | fillnull | rex field=Routing_Location mode=sed "s/,/ /g" | stats count(_raw) AS Attempts by ANI, Routing_Location | sort -Attempts

Still comes up empty

0 Karma

SplunkTrust
SplunkTrust

The problem is not with the replacement. The problem is stats will return nothing if one of the group-by fields is null. This run-anywhere example works.

| makeresults annotate=true | eval Routing_Location="USA,Cellular_Verizon" | fillnull value="None" ANI | rex field=Routing_Location mode=sed "s/,/ /g" | stats count AS Attempts by ANI, Routing_Location | sort -Attempts
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!